11.3.2 Release Notes

When upgrading Privilege Managerto a newer version, Delinea recommends upgrading the Directory Services agent such that both are running on the same release version.

Enhancements

  • A new option, Verify group membership via Domain Controller(s) allows the user to control how te domain controller is contacted to re-authenticate the user. See the New Group Member Authenticated Message Action in the documentation.
  • A new method for adding computer names to a computer group is available using the API. A resource filter is defined by a Computer by Name Filter and computer names are populated using a Powershell script. See Creating a Computer Name Filter Collection Query.
  • Windows 10 Enterprise for Virtual Desktops (EVD) machines will now consume a Client license within Privilege Manager Server rather than a Server license.

Bug Fixes

  • Correct error messages are now returned when incorrect login credentials are entered.
  • Resolved an error being displayed when using XAML notification actions when User Access Control Consent Dialog Detected filter is added as an inclusion filter.
  • Issues with the authentication token expiring and not refreshing for large Azure Active Directory imports has been addressed. Azure Active Directory domains with large databases are now correctly synced to the Privilege Manager Server.
  • An issue was resolved that caused Local Security data to unnecessarily block the deletion of some users in Privilege Manager.
  • When editing a copy of the Restrict File Dialog actions, the Disable Context Menu Options setting was not properly saved. This has been resolved.
  • When deleting Active Directory organizational units (OUs) from the UI, some related objects were not properly cleaned up, leading to errors blocking further deletes. Related objects are now properly deleted.
  • Privilege Manager has two different versions of the ServiceNow connector, one of them was sending InitiatorUserName and one was not. Now both versions should properly send InitiatorUserName with the format domain\username.
  • Privilege Manager now functions with FIPS enabled in the Windows policy (both agent and server). Upgrade will change the default inventory hash algorithm setting to SHA256 and Authenticode 2. This fixes an error with NTLM authentication when FIPS is enabled on the PM server.

Agent Specific

Windows

  • Fixed a problem where elevation fails for Advanced system settings when it is launched from System Settings and the associated policy contains an approval/justification action.

macOS

  • macOS application policies are no longer flagged as invalid when using a message action with the option Applies To All Processes when the action Allow Package Installation is also used.

Known Issues

  • There is a security issue with Windows Core agent versions 13.0.1058 and older. A fix for this issue is included in v12 versions 12.0.5804 and newer, and v13 versions 13.0.2064 and newer of the Windows Core agent which is available on the Software Downloads page.

    Delinea recommends customers who cannot immediately upgrade to use group policy or device management tooling to take the following actions on their workstations running the Privilege Manager Windows agent:

    This workaround covers remote connections. For coverage against a local connection, upgrading the Window Core agent is required.

    • Privilege Manager Cloud: Block inbound TCP on port 5593. There is no degradation in function from blocking the port.

    • Privilege Manager On-premises: Block inbound TCP on port 5593, or at least restrict it to your Privilege Managerr web server IP address. If you block the port, agents pull updates from the server based on a set schedule.